View a markdown version of this page

CloudWatch Logs AWS IoT log entries - AWS IoT Core
Message broker log entriesServer certificate OCSP log entriesDevice Shadow log entriesRules engine log entriesJob log entriesDevice provisioning log entriesDynamic thing group log entriesFleet indexing log entriesCommon CloudWatch Logs attributes

CloudWatch Logs AWS IoT log entries

Each component of AWS IoT generates its own log entries. Each log entry has an eventType that specifies the operation that caused the log entry to be generated. This section describes the log entries generated by the following AWS IoT components.

Message broker log entries

The AWS IoT message broker generates log entries for the following events:

Connect log entry

The AWS IoT message broker generates a log entry with an eventType of Connect when an MQTT client connects.

Connect success log entry example

{
    "timestamp": "2017-08-10 15:37:23.476",
    "logLevel": "INFO",
    "traceId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "accountId": "111122223333",
    "status": "Success",
    "eventType": "Connect",
    "protocol": "MQTT",
    "clientId": "abf27092886e49a8a5c1922749736453",
    "principalId": "145179c40e2219e18a909d896a5340b74cf97a39641beec2fc3eeafc5a932167",
    "sourceIp": "203.0.113.11",
    "sourcePort": 13490
}

Connect failure log entry example

{
    "timestamp": "2026-07-09 23:26:48.827",
    "logLevel": "ERROR",
    "traceId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
    "accountId": "111122223333",
    "status": "Failure",
    "eventType": "Connect",
    "protocol": "MQTT",
    "clientId": "device-12345",
    "principalId": "145179c40e2219e18a909d896a5340b74cf97a39641beec2fc3eeafc5a932167",
    "sourceIp": "203.0.113.1",
    "sourcePort": 11238,
    "reason": "throttled",
    "details": "Exceeded Connect requests per second per account limit"
}

In addition to the Common CloudWatch Logs attributes ,Connect log entries contain the following attributes:

clientId

The ID of the client making the request.

principalId

The ID of the principal making the request.

protocol

The protocol used to make the request. Valid values are MQTT or HTTP.

sourceIp

The IP address where the request originated.

sourcePort

The port where the request originated.

reason

The reason for the Connect operation failure. This field is present only when the status is Failure. Valid values are throttled, client_id_throttled, or INTERNAL_SERVER_ERROR.

details

A brief explanation of the error. This field is present only when the status is Failure.

Reason codes

The following reason codes and details appear in Connect failure log entries.

Reason Details
throttled Exceeded Connect requests per second per account limit
client_id_throttled Exceeded Connect requests per second per client ID limit

Disconnect log entry

The AWS IoT message broker generates a log entry with an eventType of Disconnect when an MQTT client disconnects.

Disconnect log entry example

{
    "timestamp": "2017-08-10 15:37:23.476",
    "logLevel": "INFO",
    "traceId": "20b23f3f-d7f1-feae-169f-82263394fbdb",
    "accountId": "123456789012",
    "status": "Success",
    "eventType": "Disconnect",
    "protocol": "MQTT",
    "clientId": "abf27092886e49a8a5c1922749736453",
    "principalId": "145179c40e2219e18a909d896a5340b74cf97a39641beec2fc3eeafc5a932167",
    "sourceIp": "205.251.233.181",
    "sourcePort": 13490,
    "reason": "DUPLICATE_CLIENT_ID",
    "details": "A new connection was established with the same client ID",
    "disconnectReason": "CLIENT_INITIATED_DISCONNECT"
}

In addition to the Common CloudWatch Logs attributes ,Disconnect log entries contain the following attributes:

clientId

The ID of the client making the request.

principalId

The ID of the principal making the request.

protocol

The protocol used to make the request. Valid values are MQTT or HTTP.

sourceIp

The IP address where the request originated.

sourcePort

The port where the request originated.

reason

The reason why the client is disconnecting.

details

A brief explanation of the error.

disconnectReason

The reason why the client is disconnecting.

Ping log entry

The AWS IoT message broker generates a log entry with an eventType of Ping when it processes an MQTT PINGREQ from a connected client and sends the corresponding PINGRESP. A single log entry is emitted per Ping operation.

Important

Ping log entries are opt-in and disabled by default. The emission threshold matches the per-entry outcome: success entries are emitted at the DEBUG level and failure entries are emitted at the ERROR level. As a result, you will see Ping failure entries whenever the event-level or Resource-specific override that applies to the connection is set to ERROR or a more verbose level (WARN, INFO, or DEBUG), but Ping success entries are published only when that level is set to DEBUG. To configure these settings, see Configure Account and Event-level logging in AWS IoT (CLI) and Configure Resource-specific overrides in AWS IoT (CLI).

On success, the logLevel is DEBUG and the status is Success. On failure (for example, when the client connection is terminated before the PINGRESP can be sent), the logLevel is ERROR and the status is Failure.

Ping log entry example (success)

{
    "timestamp": "2025-10-31 15:37:23.476",
    "logLevel": "DEBUG",
    "traceId": "20b23f3f-d7f1-feae-169f-82263394fbdb",
    "accountId": "123456789012",
    "status": "Success",
    "eventType": "Ping",
    "protocol": "MQTT",
    "latency": 128,
    "requestTimestamp": "2025-10-31 15:37:23.348",
    "responseTimestamp": "2025-10-31 15:37:23.476",
    "clientId": "abf27092886e49a8a5c1922749736453",
    "principalId": "145179c40e2219e18a909d896a5340b74cf97a39641beec2fc3eeafc5a932167",
    "sourceIp": "205.251.233.181",
    "sourcePort": 13490
}

Ping log entry example (failure)

{
    "timestamp": "2025-10-31 15:37:23.476",
    "logLevel": "ERROR",
    "traceId": "20b23f3f-d7f1-feae-169f-82263394fbdb",
    "accountId": "123456789012",
    "status": "Failure",
    "eventType": "Ping",
    "protocol": "MQTT",
    "requestTimestamp": "2025-10-31 15:37:23.476",
    "clientId": "abf27092886e49a8a5c1922749736453",
    "principalId": "145179c40e2219e18a909d896a5340b74cf97a39641beec2fc3eeafc5a932167",
    "sourceIp": "205.251.233.181",
    "sourcePort": 13490,
    "reason": "CONNECTION_ALREADY_CLOSED",
    "details": "Connection has already closed"
}

In addition to the Common CloudWatch Logs attributes, Ping log entries contain the following attributes:

protocol

The protocol used to make the request. The value is always MQTT.

latency

The time in milliseconds between receiving the PINGREQ and sending the PINGRESP. This field is present only when the status is Success.

requestTimestamp

The timestamp when AWS IoT Core received the PINGREQ from the client.

responseTimestamp

The timestamp when AWS IoT Core sent the PINGRESP to the client. This field is present only when the status is Success.

clientId

The ID of the client making the request.

principalId

The ID of the principal making the request.

sourceIp

The IP address where the request originated.

sourcePort

The port where the request originated.

reason

The reason for the Ping operation failure. This field is present only when the status is Failure.

details

A brief explanation of the error. This field is present only when the status is Failure.

Connection.AuthNError log entry

The AWS IoT message broker generates a log entry with an eventType of Connection.AuthNError when a client connection attempt is rejected due to an authentication failure. The logLevel for this log entry is always ERROR and the status is always Failure. This log entry corresponds to the Connection.AuthNError CloudWatch metric.

Important

Connection.AuthNError log entries are opt-in and disabled by default. They are emitted at the ERROR log level, so a Connection.AuthNError log entry is published only when the event-level or Resource-specific override that applies to the connection is set to ERROR or a more verbose level (WARN, INFO, or DEBUG). To configure these settings, see Configure Account and Event-level logging in AWS IoT (CLI) and Configure Resource-specific overrides in AWS IoT (CLI).

Note

This log entry is published to the AWS account that owns the Server Name Indication (SNI) provided in the TLS handshake. If the client does not provide an SNI, or the SNI cannot be resolved to an account, no log entry or metric is emitted.

Connection.AuthNError log entry example

{
    "timestamp": "2025-10-31 15:37:23.476",
    "logLevel": "ERROR",
    "traceId": "20b23f3f-d7f1-feae-169f-82263394fbdb",
    "accountId": "123456789012",
    "status": "Failure",
    "eventType": "Connection.AuthNError",
    "protocol": "MQTT",
    "authenticationType": "AWS_X509",
    "clientId": "abf27092886e49a8a5c1922749736453",
    "principalId": "145179c40e2219e18a909d896a5340b74cf97a39641beec2fc3eeafc5a932167",
    "sourceIp": "205.251.233.181",
    "sourcePort": 13490,
    "targetIp": "52.94.236.10",
    "targetPort": 8883,
    "serverNameIndication": "a1b2c3d4e5f6g7-ats.iot.us-east-1.amazonaws.com",
    "reason": "DEVICE_CERTIFICATE_NOT_REGISTERED",
    "details": "Device certificate is not registered"
}

In addition to the Common CloudWatch Logs attributes, Connection.AuthNError log entries contain the following attributes:

protocol

The protocol used to make the request. Valid values are MQTT or HTTP.

authenticationType

The type of authentication used for the connection attempt. Valid values are AWS_X509, AWS_SIGV4, CUSTOM_AUTH, and CUSTOM_AUTH_X509.

clientId

The ID of the client making the request, if available.

principalId

The ID of the principal making the request, if available.

sourceIp

The IP address where the request originated.

sourcePort

The port where the request originated.

targetIp

The destination IP address of the connection. This field might not be present in all log entries.

targetPort

The destination port of the connection.

serverNameIndication

The TLS Server Name Indication (SNI) extension hostname provided by the client.

reason

The reason why the client authentication failed. See Connection.AuthNError error codes for a list of possible values.

details

A brief description of the authentication failure.

Connection.AuthNError error codes

The following table lists the reason error codes and the corresponding details messages that can appear for a Connection.AuthNError log entry. Additional error codes may be added in the future.

Error code Error message
CUSTOM_AUTHORIZER_LAMBDA_EXECUTION_ERROR Custom authorizer Lambda invocation failed
CUSTOM_AUTHORIZER_NOT_FOUND Could not find custom authorizer
CUSTOM_AUTHORIZER_PARAMETER_INVALID Custom authentication parameter is invalid
DEVICE_CERTIFICATE_INACTIVE Device certificate is not active
DEVICE_CERTIFICATE_NOT_REGISTERED Device certificate is not registered
DEVICE_CERTIFICATE_REVOKED Device certificate is revoked
DOMAIN_CONFIGURATION_DISABLED Domain configuration for the Server Name Indication (SNI) provided is disabled
DOMAIN_CONFIGURATION_INVALID The endpoint type in domain configuration is invalid
INTERNAL_SERVER_ERROR Internal server error
NOT_AUTHENTICATED The credentials provided could not be authenticated
SECURITY_TOKEN_EXPIRED The security token is expired
SECURITY_TOKEN_INVALID The security token included in the request is invalid
SECURITY_TOKEN_SIGNATURE_MISMATCH Request signature does not match the signature provided
SNI_MISUSED The client used an SNI that is not associated with this account

DeleteConnection log entry

The AWS IoT message broker generates a log entry with an eventType of DeleteConnection when an MQTT client connection is deleted.

DeleteConnection log entry example

{
    "timestamp": "2025-08-09 15:37:23.476",
    "logLevel": "INFO",
    "traceId": "20b23f3f-d7f1-feae-169f-82263394fbdb",
    "accountId": "123456789012",
    "status": "Success",
    "eventType": "DeleteConnection",
    "protocol": "HTTP",
    "clientId": "abf27092886e49a8a5c1922749736453",
    "principalId": "145179c40e2219e18a909d896a5340b74cf97a39641beec2fc3eeafc5a932167",
    "sourceIp": "205.251.233.181",
    "sourcePort": 13490
}

In addition to the Common CloudWatch Logs attributes ,DeleteConnection log entries contain the following attributes:

clientId

The ID of the client that will be disconnected.

principalId

The ID of the principal making the request. For information about how to identify the principal using the principal ID, see Compare IAM identities and credentials in the IAM User Guide.

protocol

The protocol used to make the request. The valid value is HTTP.

sourceIp

The IP address where the request originated.

sourcePort

The port where the request originated.

GetRetainedMessage log entry

The AWS IoT message broker generates a log entry with an eventType of GetRetainedMessage when GetRetainedMessage is called.

GetRetainedMessage log entry example

{
    "timestamp": "2017-08-07 18:47:56.664", 
    "logLevel": "INFO", 
    "traceId": "1a60d02e-15b9-605b-7096-a9f584a6ad3f", 
    "accountId": "123456789012", 
    "status": "Success", 
    "eventType": "GetRetainedMessage", 
    "protocol": "HTTP",
    "topicName": "a/b/c",
    "qos": "1",
    "lastModifiedDate": "2017-08-07 18:47:56.664"
}

In addition to the Common CloudWatch Logs attributes ,GetRetainedMessage log entries contain the following attributes:

lastModifiedDate

The Epoch date and time, in milliseconds, when the retained message was stored by AWS IoT.

protocol

The protocol used to make the request. Valid value: HTTP.

qos

The Quality of Service (QoS) level used in the publish request. Valid values are 0 or 1.

topicName

The name of the subscribed topic.

ListRetainedMessage log entry

The AWS IoT message broker generates a log entry with an eventType of ListRetainedMessage when ListRetainedMessages is called.

ListRetainedMessage log entry example

{
    "timestamp": "2017-08-07 18:47:56.664", 
    "logLevel": "INFO", 
    "traceId": "1a60d02e-15b9-605b-7096-a9f584a6ad3f", 
    "accountId": "123456789012", 
    "status": "Success", 
    "eventType": "ListRetainedMessage", 
    "protocol": "HTTP"
}

In addition to the Common CloudWatch Logs attributes ,ListRetainedMessage log entries contains the following attribute:

protocol

The protocol used to make the request. Valid value: HTTP.

ListSubscriptions log entry

The AWS IoT message broker generates a log entry with an eventType of ListSubscriptions when a request to list client subscriptions is received.

ListSubscriptions log entry example

{
    "timestamp": "2025-08-22 19:57:46.587",
    "logLevel": "INFO",
    "traceId": "5bea658a-0752-bf20-770f-ad17c8dabb95",
    "accountId": "987654321",
    "status": "Success",
    "eventType": "ListSubscriptions",
    "protocol": "HTTP",
    "clientId": "abc",
    "principalId": "AIDAZPOK3C3545MCMYATF",
    "sourceIp": "52.94.133.137",
    "sourcePort": 13490,
    "maxResults": 100
}

In addition to the Common CloudWatch Logs attributes, ListSubscriptions log entries contain the following attributes:

clientId

The ID of the client making the request.

principalId

The ID of the principal making the request.

protocol

The protocol used to make the request. Valid value: HTTP.